플러그인

Uses an isolated LLM review to approve or reject DSH sandbox permission requests.

Run the main session model on a local Claude Code subscription through the official Claude Agent SDK, taking over the llm/stream route for the claude-code provider, with token-level streaming, session resume, and DSH tools bridged in over MCP so they keep DSH sandbox and approval.

Antigravity-style run_command for DSH: short commands return inline within a configurable wait window (default 10s) while longer ones auto-promote into ctx.jobs for later collection and completion notices — executed via ctx.shell under the session sandbox and approval pipeline.

LLM approval answerer for sandbox escalations beyond workspace-write: a deterministic regex filter first, then a clean-context reviewer model; humans are asked only when it is unsure. Requires the bundled core patches.

Multi-folder workspace for DeepSeek Harness: pick several folders and create one workspace spanning them (directory-flow occupant + extended workspace/sandbox contract)

OpenAI Codex CLI 래퍼: 기본 읽기 전용 샌드박스로 원샷 exec, 저장소 리뷰 및 세션 재개.

DeepSeek Harness의 자기 보호 가드레일입니다. 보호 경로 가로채기, 파괴 전 백업, CLI 자가 복구 명령, 엄격한 샌드박스 기본값을 제공합니다.

Codex 스타일 자동 검토 권한 모드로, 안전한 샌드박스 에스컬레이션은 자동 승인하고 위험하거나 모호한 경우에는 확인을 요청하며 확인되지 않은 중대한 작업은 거부하는 자동 검토 프리셋을 추가합니다.

멀티 워크스페이스 샌드박스: 등록된 모든 워크스페이스에 파일 쓰기 접근 권한을 자동으로 부여합니다 — 워크스페이스를 추가하면 즉시 쓸 수 있고, 구성이나 권한 상향이 필요 없습니다.

Microsoft 크로스 플랫폼 샌드박스 지원

Escalation-only LLM reviewer: reviews sandbox escapes only, keeps the sandbox, fails closed.

Replaces the web profile's pwsh shell executor with a subclass that rewrites every command through `rtk rewrite` before execution for token savings, running the original command unchanged on any rewrite failure (no equivalent, missing rtk, timeout) and keeping sandbox semantics intact.

Approval-free writes into whitelisted directories — wraps the filesystem fence for write/edit tools and auto-answers bash sandbox escalations that touch whitelisted paths, with a settings GUI.

Maintained fork of dsh-approval-gate. A neutral operation whose confirmation count has reached the threshold auto-approves when the judge is unavailable, instead of prompting a human again; approver-facing explanations are generated in Chinese from the real sandbox mode, command and paths. Also carries deterministic hard-deny for credential exfiltration and system-path destruction, judge-input redaction, a judge model candidate chain, fingerprint-scoped allow rules, and an approval view with unified diff and one-click revert.

Use your DSH models in [Libre WebUI](https://github.com/libre-webui/libre-webui) for chat, sandboxed Work and usage tracking, with provider credentials kept in DSH. Requires Libre WebUI 0.37.0 or later.

让 dsh 在 Windows 上使用用户自安装的 Git Bash，并绕过其沙箱限制 | Enable dsh to use a user-installed Git Bash on Windows by bypassing its sandbox restrictions.

Approval-free writes into whitelisted directories — wraps the filesystem fence for write/edit tools and auto-answers bash sandbox escalations that touch whitelisted paths, with a settings GUI.

Keeps a redundant sandbox-escalation argument from failing a tool call. Escalating tools (pwsh, bash, write, edit) advertise the full sandbox_permissions enum, but DSH only accepts a level strictly wider than the one already in effect — a check its own source calls 'deliberately not a schema constraint'. A model that reflexively passes the argument therefore picks the level it is already at and the call dies before running with 'sandbox escalation to "workspace-write" is not strictly wider than this call's current "workspace-write" mode', costing some models a whole turn of retries. This plugin registers one tools/execute waterfall listener and, only on that documented rejection and only when the arguments really carried an escalation field, re-issues the identical call once without it. Safe by DSH's own documentation: the rejection precedes any execution ('nothing has run'), and the corrected call cannot match again, so the retry is loop-free. Reproduced and verified end to end — before: isError true, the command never ran; after: the command's real output, isError false, one tool/call and one tool/result. Zero dependencies.

Make a Git for Windows installation resolvable as `bash` inside the dsh host process, so the official bash shell stack (dsh-bash-sandbox + dsh-tool-bash) can run on Windows

Engineering work-tools for DeepSeek Harness: registers two model-facing Host Tools — a scoped `git` runner, and a package-manager runner (`dev`) that detects npm/pnpm/yarn/bun from the workspace lockfile and picks the right verb per manager. Both run through dsh's sandboxed shell and return structured stdout/stderr/exitCode, so the agent gets focused, reviewable results instead of raw bash, and adding another tool is a copy-paste of one register block.

Require a real, immediately preceding sandbox denial before DSH Bash can request wider permissions.

Patch-style file editing: one apply_patch tool accepting git/unified diff (default) and Codex apply_patch syntax (opt-in), applying every change all-or-nothing after a full read-only verification pass, with sandbox-aware delete and move and a dry-run mode.

RTK (Reusable Token Kompressor) tool for DeepSeek Harness — token-optimized CLI proxy exposing read/ls/git/grep/err/test/json and more through the standard shell sandbox.

Teaching board view: agent-generated self-contained HTML is projected into a sandboxed iframe as a board, annotated by hand (brush, four colours, eraser, undo), extended in place across several tool calls, and screenshotted back into the conversation as a real user message.